DKIM Checker

Validate DKIM public key for a selector — algorithm, key size, format.

Result

No result yet

Enter the inputs above and press Run. Results appear here in a moment.

Monitor this 24/7 — get alerts on the first failure.

Only run these tools against systems you own or are authorized to test. Using them to scan or probe systems without permission violates our Terms.

What is DKIM Checker?

DKIM (DomainKeys Identified Mail, RFC 6376) is a cryptographic signature on outgoing email. The sender's mail server signs each message with a private key; the receiver fetches the matching public key from DNS and verifies the signature. A passing DKIM signature proves two things: the mail wasn't modified in transit, and it was sent by someone with access to the domain's private key.

This tool fetches the DKIM public key from <selector>._domainkey.<domain> in DNS, parses it, and validates the format (v=DKIM1, k= algorithm, p= base64-encoded key). It also reports the key size — modern minimum is 1024 bits, 2048 is recommended. Most ESP-issued selectors use 2048; some older configurations are still on 1024.

How it works

DKIM publishes a public key per selector in DNS:

1Construct the query name — DKIM keys live at <selector>._domainkey.<domain> as a TXT record. The selector is chosen by the sender — usually a short string like google, mailchimp1, selector1. The sender announces which selector they used in each message's DKIM-Signature header.
2Fetch the TXT record — Standard DNS lookup. The TXT record contains key-value pairs separated by semicolons: v=DKIM1; k=rsa; p=<base64-encoded-public-key>. Optional tags include t= (testing flag), h= (allowed hash algorithms), s= (allowed service types).
3Parse the public key — Decode the base64 in the p= tag. The decoded bytes are the DER-encoded RSA public key (modulus + exponent). From the modulus length we report the key size — 1024, 2048, or rarely 4096 bits.
4Report — Algorithm (almost always rsa), key size, presence of testing flag (t=y means signatures are advisory only), and the raw public key value. We don't validate any specific signature here — that requires the original message; this tool confirms the key is publishable and well-formed.

When you'd use it

ESP onboarding verification

Adding SendGrid, Mailchimp, etc. They give you DNS records to add for DKIM — usually CNAMEs that point to their key. After adding, run a DKIM check with their selector to confirm the key resolves and parses correctly. If not, mail will fail DKIM verification at every receiver.

Key rotation verification

Rotating DKIM keys is good security hygiene. After publishing the new key in DNS and switching the signer to use it, run a DKIM check on the new selector. Confirm the new public key is in DNS before retiring the old key — otherwise mail signed with the new key fails verification.

Debugging mail bounce with DKIM error

Recipient bounces with "DKIM verification failed" or "no DKIM record found." Check the selector mentioned in the DKIM-Signature header (s=<selector>). If the lookup returns NXDOMAIN, the selector isn't published — the signer is referencing a key that doesn't exist publicly.

Audit for weak keys

Periodic check across all your active selectors. Anything still on 1024 bits is below modern recommendation — rotate to 2048. Some old setups use 512-bit keys; those are cryptographically broken and need immediate rotation.

Investigating spoofed mail

Spoofer is using your domain. Check whether your DKIM selectors are reachable and well-formed; receivers using DMARC will reject mail that doesn't have a valid DKIM signature aligned with the From: header. If your DKIM setup is broken, even legitimate mail won't have a valid signature for DMARC alignment.

Reading the result

Key size

1024 bits = minimum but considered weak by modern standards. 2048 bits = current best practice. 4096 bits = very secure but larger DNS records (may exceed 255-byte TXT segment limit, must be split into multiple strings concatenated). Modern: use 2048.

Algorithm (`k=`)

Almost always rsa. RFC 8463 added ed25519 support — much smaller keys, faster verification — but ESP adoption is still limited. If you see ed25519 in your key, the receiver must support RFC 8463 to verify; older receivers will ignore.

Testing flag (`t=y`)

Means signatures are advisory — receivers should treat verification failures as if DKIM wasn't present. Useful during initial rollout. Remove the flag once you're confident your signer is working correctly.

Public key value (`p=`)

Base64-encoded DER public key. If p= is empty (just p=), the key has been revoked — receivers will treat all signatures with this selector as failed. If absent entirely, the record is invalid.

Common pitfalls

Selector exists but the key is malformed

Truncated public keys are surprisingly common — DNS TXT records have a 255-byte limit per string, longer values must be split into multiple quoted strings that concatenate. Some hosts mishandle the splitting and produce truncated keys. Result: signature verification fails because the public key is incomplete.

DKIM passes locally but fails at the receiver

Could be: (1) your selector resolves from your network but not from public DNS (split-horizon misconfiguration); (2) message was modified in transit (mailing list adds a footer) — content modification invalidates DKIM; (3) signature uses an algorithm the receiver doesn't support.

Multiple DKIM records at the same selector

Only one is valid per selector. If two exist (maybe from copy-paste during rotation), receivers may pick either — usually the one that comes first. Consolidate to one.

CNAME-based ESP DKIM not resolving

Many ESPs use CNAME records (your dkim1._domainkey.example.com CNAMEs to dkim1.example.com.sendgrid.net). If your DNS provider doesn't allow CNAMEs at non-apex labels, the lookup fails. Some providers (Cloudflare, Route53) handle this with flattening; others require you to publish the TXT directly.

Run DKIM Checker on every change, not just once.

Get alerts the moment something breaks — across HTTP, DNS, SSL, RDAP, ping, blacklist and more. Free forever for 10 monitors. No card.

Start free

Frequently asked questions

What's a DKIM selector and why do ESPs use different ones?

A selector is just a label so one domain can publish multiple DKIM keys — for rotation, for multiple senders, or for different traffic types. Each sender announces which selector they used in the s= tag of the message's DKIM-Signature header.

How often should I rotate DKIM keys?

Best practice: every 6-12 months. Rotation reduces exposure if a key is ever compromised, and it forces you to validate your DNS publishing pipeline regularly. Most ESPs rotate automatically; for self-signed setups, schedule it.

What does an empty p= value mean?

Revoked key. The selector still exists but the key has been explicitly removed — receivers MUST treat any signature for this selector as failed. Used during emergency revocation of a compromised key.

Can I use a single DKIM key for multiple domains?

No — DKIM is per-domain. Each domain needs its own DNS record with its own public key. You can use the SAME public key on multiple domains if you publish it independently at each, but it's better practice to use separate keys per domain.

Why does my DKIM record exceed 255 bytes?

2048-bit RSA keys encode to a base64 string longer than 255 bytes. DNS TXT records limit each string to 255 bytes — longer values must be split into multiple quoted strings: "v=DKIM1; k=rsa; " "p=MIIBIj...continued...". Receivers concatenate. Some DNS hosts handle this automatically; some require manual splitting.

Does DKIM by itself prevent spoofing?

Not on its own — DKIM proves the message wasn't modified and came from someone with the private key, but receivers need DMARC to enforce that DKIM passed AND the signing domain aligns with the From: header. Without DMARC, a spoofer can sign with their own DKIM key and the message still has a "valid" DKIM signature.

What's ed25519 DKIM and should I use it?

Newer signing algorithm (RFC 8463). Much smaller keys and signatures, faster to verify. The catch: receivers must support it. As of writing, support is improving but not universal. Safe approach: publish both RSA and ed25519 selectors during the transition.

How do I find out what selector my ESP is using?

Send yourself a test message through the ESP. Look at the raw email headers — the DKIM-Signature header contains s=<selector>. That's the selector to look up. ESPs often list their selectors in their documentation too.